#include <assert.h>

#include <stddef.h>

#include "php_http_parser.h"

#ifndef MIN

# define MIN(a,b) ((a) < (b) ? (a) : (b))

#define CALLBACK2(FOR) \

do { \

if (settings->on_##FOR) { \

if (0 != settings->on_##FOR(parser)) return (p - data); \

} \

} while (0)

#define MARK(FOR) \

do { \

FOR##_mark = p; \

} while (0)

#define CALLBACK_NOCLEAR(FOR) \

do { \

if (FOR##_mark) { \

if (settings->on_##FOR) { \

if (0 != settings->on_##FOR(parser, \

FOR##_mark, \

p - FOR##_mark)) \

{ \

return (p - data); \

} \

} \

} \

} while (0)

#ifdef PHP_WIN32

# undef CALLBACK

#define CALLBACK(FOR) \

do { \

CALLBACK_NOCLEAR(FOR); \

FOR##_mark = NULL; \

} while (0)

#define PROXY_CONNECTION "proxy-connection"

#define CONNECTION "connection"

#define CONTENT_LENGTH "content-length"

#define TRANSFER_ENCODING "transfer-encoding"

#define UPGRADE "upgrade"

#define CHUNKED "chunked"

#define KEEP_ALIVE "keep-alive"

#define CLOSE "close"

static const char *method_strings[] =

{ "DELETE"

, "GET"

, "HEAD"

, "POST"

, "PUT"

, "PATCH"

, "CONNECT"

, "OPTIONS"

, "TRACE"

, "COPY"

, "LOCK"

, "MKCOL"

, "MOVE"

, "PROPFIND"

, "PROPPATCH"

, "UNLOCK"

, "REPORT"

, "MKACTIVITY"

, "CHECKOUT"

, "MERGE"

, "M-SEARCH"

, "NOTIFY"

, "SUBSCRIBE"

, "UNSUBSCRIBE"

, "NOTIMPLEMENTED"

};

static const char tokens[256] = {

0, 0, 0, 0, 0, 0, 0, 0,

0, 0, 0, 0, 0, 0, 0, 0,

0, 0, 0, 0, 0, 0, 0, 0,

0, 0, 0, 0, 0, 0, 0, 0,

' ', '!', '"', '#', '$', '%', '&', '\'',

0, 0, '*', '+', 0, '-', '.', '/',

'0', '1', '2', '3', '4', '5', '6', '7',

'8', '9', 0, 0, 0, 0, 0, 0,

0, 'a', 'b', 'c', 'd', 'e', 'f', 'g',

'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o',

'p', 'q', 'r', 's', 't', 'u', 'v', 'w',

'x', 'y', 'z', 0, 0, 0, '^', '_',

'`', 'a', 'b', 'c', 'd', 'e', 'f', 'g',

'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o',

'p', 'q', 'r', 's', 't', 'u', 'v', 'w',

'x', 'y', 'z', 0, '|', '}', '~', 0 };

static const int8_t unhex[256] =

{-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1

,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1

,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1

, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9,-1,-1,-1,-1,-1,-1

,-1,10,11,12,13,14,15,-1,-1,-1,-1,-1,-1,-1,-1,-1

,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1

,-1,10,11,12,13,14,15,-1,-1,-1,-1,-1,-1,-1,-1,-1

,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1

};

static const uint8_t normal_url_char[256] = {

0, 0, 0, 0, 0, 0, 0, 0,

0, 0, 0, 0, 0, 0, 0, 0,

0, 0, 0, 0, 0, 0, 0, 0,

0, 0, 0, 0, 0, 0, 0, 0,

0, 1, 1, 0, 1, 1, 1, 1,

1, 1, 1, 1, 1, 1, 1, 1,

1, 1, 1, 1, 1, 1, 1, 1,

1, 1, 1, 1, 1, 1, 1, 0,

1, 1, 1, 1, 1, 1, 1, 1,

1, 1, 1, 1, 1, 1, 1, 1,

1, 1, 1, 1, 1, 1, 1, 1,

1, 1, 1, 1, 1, 1, 1, 1,

1, 1, 1, 1, 1, 1, 1, 1,

1, 1, 1, 1, 1, 1, 1, 1,

1, 1, 1, 1, 1, 1, 1, 1,

1, 1, 1, 1, 1, 1, 1, 0 };

enum state

};

#define PARSING_HEADER(state) (state <= s_headers_almost_done && 0 == (parser->flags & F_TRAILING))

enum header_states

};

enum flags

};

#define CR '\r'

#define LF '\n'

#define LOWER(c) (unsigned char)(c | 0x20)

#define TOKEN(c) tokens[(unsigned char)c]

#define start_state (parser->type == PHP_HTTP_REQUEST ? s_start_req : s_start_res)

#if HTTP_PARSER_STRICT

# define STRICT_CHECK(cond) if (cond) goto error

# define NEW_MESSAGE() (http_should_keep_alive(parser) ? start_state : s_dead)

# define STRICT_CHECK(cond)

# define NEW_MESSAGE() start_state

size_t php_http_parser_execute (php_http_parser *parser,

const php_http_parser_settings *settings,

const char *data,

size_t len)

{

char c, ch;

const char *p = data, *pe;

size_t to_read;

enum state state = (enum state) parser->state;

enum header_states header_state = (enum header_states) parser->header_state;

uint32_t index = parser->index;

uint32_t nread = parser->nread;

/* technically we could combine all of these (except for url_mark) into one

const char *header_field_mark = 0;

const char *header_value_mark = 0;

const char *fragment_mark = 0;

const char *query_string_mark = 0;

const char *path_mark = 0;

const char *url_mark = 0;

if (len == 0) {

if (state == s_body_identity_eof) {

CALLBACK2(message_complete);

}

return 0;

}

if (state == s_header_field)

header_field_mark = data;

if (state == s_header_value)

header_value_mark = data;

if (state == s_req_fragment)

fragment_mark = data;

if (state == s_req_query_string)

query_string_mark = data;

if (state == s_req_path)

path_mark = data;

if (state == s_req_path || state == s_req_schema || state == s_req_schema_slash

|| state == s_req_schema_slash_slash || state == s_req_port

|| state == s_req_query_string_start || state == s_req_query_string

|| state == s_req_host

|| state == s_req_fragment_start || state == s_req_fragment)

url_mark = data;

for (p=data, pe=data+len; p != pe; p++) {

ch = *p;

if (PARSING_HEADER(state)) {

++nread;

/* Buffer overflow attack */

if (nread > PHP_HTTP_MAX_HEADER_SIZE) goto error;

}

switch (state) {

case s_dead:

/* this state is used after a 'Connection: close' message

goto error;

case s_start_req_or_res:

{

if (ch == CR || ch == LF)

break;

parser->flags = 0;

parser->content_length = -1;

CALLBACK2(message_begin);

if (ch == 'H')

state = s_res_or_resp_H;

else {

parser->type = PHP_HTTP_REQUEST;

goto start_req_method_assign;

}

break;

}

case s_res_or_resp_H:

if (ch == 'T') {

parser->type = PHP_HTTP_RESPONSE;

state = s_res_HT;

} else {

if (ch != 'E') goto error;

parser->type = PHP_HTTP_REQUEST;

parser->method = PHP_HTTP_HEAD;

index = 2;

state = s_req_method;

}

break;

case s_start_res:

{

parser->flags = 0;

parser->content_length = -1;

CALLBACK2(message_begin);

switch (ch) {

case 'H':

state = s_res_H;

break;

case CR:

case LF:

break;

default:

goto error;

}

break;

}

case s_res_H:

STRICT_CHECK(ch != 'T');

state = s_res_HT;

break;

case s_res_HT:

STRICT_CHECK(ch != 'T');

state = s_res_HTT;

break;

case s_res_HTT:

STRICT_CHECK(ch != 'P');

state = s_res_HTTP;

break;

case s_res_HTTP:

STRICT_CHECK(ch != '/');

state = s_res_first_http_major;

break;

case s_res_first_http_major:

if (ch < '1' || ch > '9') goto error;

parser->http_major = ch - '0';

state = s_res_http_major;

break;

/* major HTTP version or dot */

case s_res_http_major:

{

if (ch == '.') {

state = s_res_first_http_minor;

break;

}

if (ch < '0' || ch > '9') goto error;

parser->http_major *= 10;

parser->http_major += ch - '0';

if (parser->http_major > 999) goto error;

break;

}

/* first digit of minor HTTP version */

case s_res_first_http_minor:

if (ch < '0' || ch > '9') goto error;

parser->http_minor = ch - '0';

state = s_res_http_minor;

break;

/* minor HTTP version or end of request line */

case s_res_http_minor:

{

if (ch == ' ') {

state = s_res_first_status_code;

break;

}

if (ch < '0' || ch > '9') goto error;

parser->http_minor *= 10;

parser->http_minor += ch - '0';

if (parser->http_minor > 999) goto error;

break;

}

case s_res_first_status_code:

{

if (ch < '0' || ch > '9') {

if (ch == ' ') {

break;

}

goto error;

}

parser->status_code = ch - '0';

state = s_res_status_code;

break;

}

case s_res_status_code:

{

if (ch < '0' || ch > '9') {

switch (ch) {

case ' ':

state = s_res_status;

break;

case CR:

state = s_res_line_almost_done;

break;

case LF:

state = s_header_field_start;

break;

default:

goto error;

}

break;

}

parser->status_code *= 10;

parser->status_code += ch - '0';

if (parser->status_code > 999) goto error;

break;

}

case s_res_status:

/* the human readable status. e.g. "NOT FOUND"

if (ch == CR) {

state = s_res_line_almost_done;

break;

}

if (ch == LF) {

state = s_header_field_start;

break;

}

break;

case s_res_line_almost_done:

STRICT_CHECK(ch != LF);

state = s_header_field_start;

break;

case s_start_req:

{

if (ch == CR || ch == LF)

break;

parser->flags = 0;

parser->content_length = -1;

CALLBACK2(message_begin);

if (ch < 'A' || 'Z' < ch) goto error;

start_req_method_assign:

parser->method = (enum php_http_method) 0;

index = 1;

switch (ch) {

case 'C': parser->method = PHP_HTTP_CONNECT; /* or COPY, CHECKOUT */ break;

case 'D': parser->method = PHP_HTTP_DELETE; break;

case 'G': parser->method = PHP_HTTP_GET; break;

case 'H': parser->method = PHP_HTTP_HEAD; break;

case 'L': parser->method = PHP_HTTP_LOCK; break;

case 'M': parser->method = PHP_HTTP_MKCOL; /* or MOVE, MKACTIVITY, MERGE, M-SEARCH */ break;

case 'N': parser->method = PHP_HTTP_NOTIFY; break;

case 'O': parser->method = PHP_HTTP_OPTIONS; break;

case 'P': parser->method = PHP_HTTP_POST; /* or PROPFIND or PROPPATCH or PUT */ break;

case 'R': parser->method = PHP_HTTP_REPORT; break;

case 'S': parser->method = PHP_HTTP_SUBSCRIBE; break;

case 'T': parser->method = PHP_HTTP_TRACE; break;

case 'U': parser->method = PHP_HTTP_UNLOCK; /* or UNSUBSCRIBE */ break;

default: parser->method = PHP_HTTP_NOT_IMPLEMENTED; break;

}

state = s_req_method;

break;

}

case s_req_method:

{

const char *matcher;

if (ch == '\0')

goto error;

matcher = method_strings[parser->method];

if (ch == ' ' && (matcher[index] == '\0' || parser->method == PHP_HTTP_NOT_IMPLEMENTED)) {

state = s_req_spaces_before_url;

} else if (ch == matcher[index]) {

; /* nada */

} else if (parser->method == PHP_HTTP_CONNECT) {

if (index == 1 && ch == 'H') {

parser->method = PHP_HTTP_CHECKOUT;

} else if (index == 2 && ch == 'P') {

parser->method = PHP_HTTP_COPY;

}

} else if (parser->method == PHP_HTTP_MKCOL) {

if (index == 1 && ch == 'O') {

parser->method = PHP_HTTP_MOVE;

} else if (index == 1 && ch == 'E') {

parser->method = PHP_HTTP_MERGE;

} else if (index == 1 && ch == '-') {

parser->method = PHP_HTTP_MSEARCH;

} else if (index == 2 && ch == 'A') {

parser->method = PHP_HTTP_MKACTIVITY;

}

} else if (index == 1 && parser->method == PHP_HTTP_POST && ch == 'R') {

parser->method = PHP_HTTP_PROPFIND; /* or HTTP_PROPPATCH */

} else if (index == 1 && parser->method == PHP_HTTP_POST && ch == 'U') {

parser->method = PHP_HTTP_PUT;

} else if (index == 1 && parser->method == PHP_HTTP_POST && ch == 'A') {

parser->method = PHP_HTTP_PATCH;

} else if (index == 2 && parser->method == PHP_HTTP_UNLOCK && ch == 'S') {

parser->method = PHP_HTTP_UNSUBSCRIBE;

} else if (index == 4 && parser->method == PHP_HTTP_PROPFIND && ch == 'P') {

parser->method = PHP_HTTP_PROPPATCH;

} else {

parser->method = PHP_HTTP_NOT_IMPLEMENTED;

}

++index;

break;

}

case s_req_spaces_before_url:

{

if (ch == ' ') break;

if (ch == '/' || ch == '*') {

MARK(url);

MARK(path);

state = s_req_path;

break;

}

c = LOWER(ch);

if (c >= 'a' && c <= 'z') {

MARK(url);

state = s_req_schema;

break;

}

goto error;

}

case s_req_schema:

{

c = LOWER(ch);

if (c >= 'a' && c <= 'z') break;

if (ch == ':') {

state = s_req_schema_slash;

break;

} else if (ch == '.') {

state = s_req_host;

break;

} else if ('0' <= ch && ch <= '9') {

state = s_req_host;

break;

}

goto error;

}

case s_req_schema_slash:

STRICT_CHECK(ch != '/');

state = s_req_schema_slash_slash;

break;

case s_req_schema_slash_slash:

STRICT_CHECK(ch != '/');

state = s_req_host;

break;

case s_req_host:

{

c = LOWER(ch);

if (c >= 'a' && c <= 'z') break;

if ((ch >= '0' && ch <= '9') || ch == '.' || ch == '-') break;

switch (ch) {

case ':':

state = s_req_port;

break;

case '/':

MARK(path);

state = s_req_path;

break;

case ' ':

/* The request line looks like:

CALLBACK(url);

state = s_req_http_start;

break;

default:

goto error;

}

break;

}

case s_req_port:

{

if (ch >= '0' && ch <= '9') break;

switch (ch) {

case '/':

MARK(path);

state = s_req_path;

break;

case ' ':

/* The request line looks like:

CALLBACK(url);

state = s_req_http_start;

break;

default:

goto error;

}

break;

}

case s_req_path:

{

if (normal_url_char[(unsigned char)ch]) break;

switch (ch) {

case ' ':

CALLBACK(url);

CALLBACK(path);

state = s_req_http_start;

break;

case CR:

CALLBACK(url);

CALLBACK(path);

parser->http_major = 0;

parser->http_minor = 9;

state = s_req_line_almost_done;

break;

case LF:

CALLBACK(url);

CALLBACK(path);

parser->http_major = 0;

parser->http_minor = 9;

state = s_header_field_start;

break;

case '?':

CALLBACK(path);

state = s_req_query_string_start;

break;

case '#':

CALLBACK(path);

state = s_req_fragment_start;

break;

default:

goto error;

}

break;

}

case s_req_query_string_start:

{

if (normal_url_char[(unsigned char)ch]) {

MARK(query_string);

state = s_req_query_string;

break;

}

switch (ch) {

case '?':

break; /* XXX ignore extra '?' ... is this right? */

case ' ':

CALLBACK(url);

state = s_req_http_start;

break;

case CR:

CALLBACK(url);

parser->http_major = 0;

parser->http_minor = 9;

state = s_req_line_almost_done;

break;

case LF:

CALLBACK(url);

parser->http_major = 0;

parser->http_minor = 9;

state = s_header_field_start;

break;

case '#':

state = s_req_fragment_start;

break;

default:

goto error;

}

break;

}

case s_req_query_string:

{

if (normal_url_char[(unsigned char)ch]) break;

switch (ch) {

case '?':

/* allow extra '?' in query string */

break;

case ' ':

CALLBACK(url);

CALLBACK(query_string);

state = s_req_http_start;

break;

case CR:

CALLBACK(url);

CALLBACK(query_string);

parser->http_major = 0;

parser->http_minor = 9;

state = s_req_line_almost_done;

break;

case LF:

CALLBACK(url);

CALLBACK(query_string);

parser->http_major = 0;

parser->http_minor = 9;

state = s_header_field_start;

break;

case '#':

CALLBACK(query_string);

state = s_req_fragment_start;

break;

default:

goto error;

}

break;

}

case s_req_fragment_start:

{

if (normal_url_char[(unsigned char)ch]) {

MARK(fragment);

state = s_req_fragment;

break;

}

switch (ch) {

case ' ':

CALLBACK(url);

state = s_req_http_start;

break;

case CR:

CALLBACK(url);

parser->http_major = 0;

parser->http_minor = 9;

state = s_req_line_almost_done;

break;

case LF:

CALLBACK(url);

parser->http_major = 0;

parser->http_minor = 9;

state = s_header_field_start;

break;

case '?':

MARK(fragment);

state = s_req_fragment;

break;

case '#':

break;

default:

goto error;

}

break;

}

case s_req_fragment:

{

if (normal_url_char[(unsigned char)ch]) break;

switch (ch) {

case ' ':

CALLBACK(url);

CALLBACK(fragment);

state = s_req_http_start;

break;

case CR:

CALLBACK(url);

CALLBACK(fragment);

parser->http_major = 0;

parser->http_minor = 9;

state = s_req_line_almost_done;

break;

case LF:

CALLBACK(url);

CALLBACK(fragment);

parser->http_major = 0;

parser->http_minor = 9;

state = s_header_field_start;

break;

case '?':

case '#':

break;

default:

goto error;

}

break;

}

case s_req_http_start:

switch (ch) {

case 'H':

state = s_req_http_H;

break;

case ' ':

break;

default:

goto error;

}

break;

case s_req_http_H:

STRICT_CHECK(ch != 'T');

state = s_req_http_HT;

break;

case s_req_http_HT:

STRICT_CHECK(ch != 'T');

state = s_req_http_HTT;

break;

case s_req_http_HTT:

STRICT_CHECK(ch != 'P');

state = s_req_http_HTTP;

break;

case s_req_http_HTTP:

STRICT_CHECK(ch != '/');

state = s_req_first_http_major;

break;

/* first digit of major HTTP version */

case s_req_first_http_major:

if (ch < '1' || ch > '9') goto error;

parser->http_major = ch - '0';

state = s_req_http_major;

break;

/* major HTTP version or dot */

case s_req_http_major:

{

if (ch == '.') {

state = s_req_first_http_minor;

break;

}

if (ch < '0' || ch > '9') goto error;

parser->http_major *= 10;

parser->http_major += ch - '0';

if (parser->http_major > 999) goto error;

break;

}

/* first digit of minor HTTP version */

case s_req_first_http_minor:

if (ch < '0' || ch > '9') goto error;

parser->http_minor = ch - '0';

state = s_req_http_minor;

break;

/* minor HTTP version or end of request line */

case s_req_http_minor:

{

if (ch == CR) {

state = s_req_line_almost_done;

break;

}

if (ch == LF) {

state = s_header_field_start;

break;

}